Credentials Are Compromised
Everywhere.

Attack Vector

Vendor credential theft → lateral movement → POS malware

What Happened

A 12-person HVAC contractor (Fazio Mechanical) had network access to Target for electronic billing. Attackers phished one employee, stole valid credentials, and used them to pivot through Target’s network and exfiltrate 40 million credit cards over a 19-day window during the holiday shopping season.

Attack Vector

Supply chain → Ukrainian tax software (M.E.Doc) auto-update poisoned

What Happened

A poisoned auto-update from a Ukrainian tax accounting software (M.E.Doc) deployed wiper malware disguised as ransomware. Maersk alone lost ~$300M and had global shipping operations halted for weeks. Total worldwide damages exceeded $10B — the costliest cyberattack in history.

Attack Vector

Build system compromise → trojanized software updates → dormant backdoor

What Happened

Russian state actors compromised SolarWinds’ build pipeline and inserted a backdoor (Sunburst) into legitimate Orion software updates. Over 18,000 organizations downloaded the trojanized update, including the US Treasury, DHS, Commerce, and Microsoft. Attackers used the foothold to access classified email systems for months.

Attack Vector

Single compromised VPN credential, no MFA enabled

What Happened

Attackers used a single leaked VPN password to access the Colonial Pipeline corporate network, deployed DarkSide ransomware, and forced a 6-day shutdown of the largest fuel pipeline on the US East Coast. The shutdown caused gas shortages and panic buying across multiple states. Colonial paid a $4.4M ransom; the FBI later recovered ~$2.3M.

Attack Vector

SMS phishing → fake Okta login → MFA bypass via session token theft

What Happened

A coordinated SMS phishing campaign targeted employees at 130+ companies including Twilio, Cloudflare, MailChimp, and DoorDash. Attackers harvested credentials through fake Okta login pages and used the access to pivot into customer accounts. Twilio confirmed unauthorized access to 209 customer accounts. Signal users were affected via Twilio’s 2FA infrastructure.

Attack Vector

MFA fatigue attack → social engineering → hardcoded admin credentials

What Happened

An 18-year-old attacker bombarded an Uber contractor with MFA push notifications, then social-engineered them via WhatsApp claiming to be Uber IT. Once inside the VPN, the attacker found hardcoded admin credentials in a PowerShell script and pivoted to AWS, GSuite, Slack, and HackerOne — effectively owning the entire company.

Attack Vector

DevOps engineer’s home computer → keylogger → master vault access

What Happened

A multi-stage breach: attackers first stole source code in August 2022, then in a second incident exploited a vulnerability in a media player on a senior DevOps engineer’s home computer to install a keylogger. They captured the engineer’s LastPass master password and exfiltrated the encrypted customer vault backups, including encrypted password vaults of all customers.

Attack Vector

Zero-day SQL injection in trusted file transfer software

What Happened

Cl0p exploited a zero-day SQL injection vulnerability (CVE-2023-34362) in Progress Software’s MOVEit Transfer — a trusted enterprise file transfer tool used by thousands of organizations. They exfiltrated data from 2,700+ companies including the US Department of Energy, Shell, British Airways, the BBC, and the Oregon DMV. Total impact: $9.9B+ in damages.

Attack Vector

Social engineering of IT helpdesk → password reset → ransomware

What Happened

Attackers found an MGM employee on LinkedIn, called the IT helpdesk pretending to be them, and convinced support staff to reset MFA. Within hours they had domain admin access and deployed ALPHV ransomware. MGM’s casino floors, hotel keycards, slot machines, and reservation systems went dark for 10+ days. Loss: ~$100M plus reputational damage.

Attack Vector

Citrix portal with no MFA → lateral movement → ransomware + data theft

What Happened

Attackers used compromised credentials to access a Citrix remote portal that lacked multi-factor authentication, then spent 9 days inside Change Healthcare’s network before deploying ransomware. The attack disrupted prescription processing, claims, and payments for thousands of US healthcare providers for weeks. UnitedHealth paid a $22M ransom; total impact exceeded $2.4B.